Probabilistic Host Authentication for DDoS Mitigation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for mitigating distributed denial-of-service (DDoS) attacks require large amounts of memory to track and authenticate host addresses, leading to memory exhaustion during high-traffic attacks, making it difficult to distinguish legitimate from attack traffic and preventing effective protection against large-scale attacks.
Innovation Solution
Implementing a probabilistic filter, such as a Bloom filter, to efficiently track and authenticate host addresses, allowing for the protection of larger volumes of traffic without significant memory overhead, while minimizing disruption to legitimate traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a protection system tracks and authenticates all host addresses using traditional methods, then authentication accuracy is improved, but memory consumption increases significantly during high-traffic attacks
Solution Approach 1:
The patent transforms the exact matching parameter into probabilistic matching by using Bloom filters. Instead of storing and comparing complete host addresses exactly, the system converts addresses into hash values and uses probabilistic set membership testing. This parameter change allows the system to handle large volumes of traffic with limited memory while maintaining acceptable authentication accuracy through multiple hash function comparisons.
Solution Approach 2:
The patent creates a compressed representation (copy) of the host address space using Bloom filters. Rather than storing actual host addresses in memory, the system stores hash values that probabilistically represent the presence or absence of addresses. This copying approach reduces memory consumption from storing millions of actual addresses to storing only the filter bits required for probabilistic testing.
2Productivity
If the protection system increases memory capacity to handle larger attack volumes, then attack mitigation capability is improved, but system cost and complexity increase
Solution Approach 1:
The patent segments the authentication process into two stages: a fast probabilistic filtering stage using Bloom filters for initial screening, and a subsequent verification stage for confirmed matches. This segmentation allows the system to handle large attack volumes by quickly eliminating non-matching addresses in the first stage without requiring proportional increases in memory capacity or system complexity.
3Reliability
If traditional authentication methods are used to distinguish legitimate from attack traffic, then traffic security is improved, but processing speed decreases during high-traffic scenarios
Solution Approach 1:
The patent performs preliminary action by pre-computing and storing hash values of host addresses in the Bloom filter before authentication is needed. During actual authentication, the system only needs to perform fast hash computations and bit checks rather than storing or comparing complete addresses. This preliminary preparation enables rapid processing of high-traffic scenarios while maintaining security through the probabilistic matching mechanism.
Data Source
AI summary
A system and method to track external devices attempting to connect to a protected network using probabilistic filters. When a connection from a new external device attempts to access the protected network, the memory of a protection system, which is organized as a probabilistic filter, is searched to determine if the IP address already exists in the memory of protection system. If the search locates the IP address, the protection system terminates the connection to the external device. If the search is negative, then protection device begins the authentication process for the external device.